Aruba ClearPass User Added to Privileged Role
Detects a user being added to a role within ClearPass. Role membership determines what the network will permit an identity to reach, so granting a privileged role is a network-layer privilege escalation that leaves no trace on any endpoint. Additions outside provisioning hours, or by an account that does not normally administer ClearPass, are the ones worth pursuing. Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261). Integration guide: https://bloo.io/docs/integrations/aruba-clearpass BQL (Bloo Query Language): stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_ADDED' | groupby user, targetuser, role, srcip
Sigma
